65 Victims, $415K, 4 Days: Inside Coinbase's Takedown With the FBI and NCA

How a crypto exchange's intelligence team turned live blockchain tracing into frozen assets and real-time arrests during Joint Disruption Week

LONDON, Oct. 13, 2026, In four days inside the UK National Crime Agency headquarters, investigators from Coinbase's Global Intelligence team helped do what takedown notices alone cannot: they stopped money while it was moving.

Coinbase took part in a four-day operation in London from Oct. 6 to 9 targeting West African scam networks, hosted by the UK's National Crime Agency with the U.S. Department of Justice's Scam Center Strike Force.

The company's role was financial, not content moderation. "We traced illicit funds, helped freeze assets tied to scam networks, and shared intelligence with law enforcement in real time," the company said in its Oct. 13 post on the operation.

The numbers

That work produced two metrics that now sit alongside arrests in the official results:

• More than 65 active scam victims proactively identified
• More than $415,000 in potential losses stopped before they occurred

The figures were listed by Meta in the joint results, alongside its own removal of 3.7 million accounts, Pages and Groups and Microsoft's suspension of associated accounts.

A separate summary of the NCA release cited the same Coinbase numbers as evidence that platforms are now measured on prevention, not just takedowns.

How it worked

Joint Disruption Week was the first coordinated effort focused specifically on West Africa, bringing together the FBI, U.S. Secret Service, Homeland Security Investigations, Ghanaian and Nigerian cybercrime units, plus Australia, Canada, India, New Zealand and INTERPOL.

Coinbase operated shoulder to shoulder with law enforcement and the Tech Against Scams coalition.

Instead of filing suspicious activity reports after the fact, analysts traced illicit fund flows, assisted in freezing involved assets, and fed wallet clusters and laundering patterns directly to agents who could link them to physical scam compounds.

That full chain approach mattered.

The wider coalition shared leads on more than 30 suspected scam centers, leading to 28 arrests, 19 in Sasaabi, Ghana with 303 devices seized and nine in Nigeria.

In total, private sector partners identified over $11 million in potentially freezable funds.

Why exchanges are now frontline

The West African networks hit in London were running investment fraud, including pig-butchering crypto schemes, alongside job-task scams, law enforcement impersonation, romance scams and non-delivery fraud.

For those schemes, the exchange is the choke point.

Criminals can spin up thousands of social profiles, and did, but they still need to cash out.

Coinbase's visibility across addresses and peer-to-peer laundering networks, combined with blockchain analytics from partners like Chainalysis, Elliptic and TRM Labs, gave investigators a live map from victim deposit to scam wallet to operator.

Leah Bressack, Vice President at Coinbase, tied London to earlier work in Southeast Asia:

"When we disrupted scam compounds in Southeast Asia earlier this year, we proved that coordinated action across industry and law enforcement works. As criminal networks try to reestablish in Africa, Coinbase's Global Intelligence team is following the money, freezing assets, and sharing intelligence in real time so law enforcement can act. This is what sustained pressure looks like."

What comes next

The DOJ has signaled the model will repeat.

Its Cyber-Enabled Scam Initiative and Scam Center Strike Force were built for this type of public-private co-location, and officials say the intelligence gained in London will harden detection models for the next haven criminals try.

For cybercrime defenders, the takeaway is numeric and operational: 65 victims found early is 65 cases that never become $8.3 million in losses like those documented in Ghana.

In a 4-day window, that prevention may prove as disruptive as any raid.